This notice explains how [GapZero Ltd] (GapZero, we, us) collects and uses personal data when you visit our website or use the GapZero service (the Service), and the rights you have under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and, where it applies, the EU GDPR.
1. Who we are
[GapZero Ltd] is a company registered in England and Wales (company number [00000000]), registered office [registered address]. We are registered with the Information Commissioner's Office under number [ZA000000].
For any question about this notice or your personal data, contact us at [privacy@gapzero.com].
2. Our role: controller and processor
GapZero is used by organisations (our customers) to understand the skills of their people. How we handle your data depends on your relationship with us:
- When we are the controller. We decide how and why we use the personal data needed to run our business: website visits, account sign-up and sign-in, billing, support, service emails and keeping the Service secure.
- When your employer is the controller. If your employer or organisation invited you to GapZero, the information about you in their workspace, such as your department, skills and proficiency ratings, is processed by us on their behalf and under their instructions. Your employer is the controller of that data and we are their processor. For questions about how your employer uses it, or to exercise your rights over it, please contact your employer first. We will help them respond.
3. The personal data we collect
| Category | Examples | Source |
|---|---|---|
| Account data | Name, email address, password (stored only as a secure hash), role in an organisation | You, or the person who invited you |
| Organisation data | Organisation name, industry, departments, plan and seat count | The organisation's owner |
| Skills data | Skills you hold, proficiency ratings out of 10, notes, your department | You, or your organisation's owner |
| Reports | Coverage figures, skill gaps, single points of failure, training suggestions and saved audits built from skills data | Generated by the Service |
| Invitation data | Email address of an invited person, the department they're invited to, invitation status | The organisation's owner |
| Billing data | Billing contact, subscription and invoice history. Card details are collected and held by Stripe, not by us. | The organisation's owner, Stripe |
| Communications | Emails and support requests you send us | You |
| Technical and security data | IP address, browser and device type, sign-in times, server logs | Your device, our systems |
We do not ask for special category data (such as health, ethnicity or religion) and you should not enter it into the Service.
4. How we use it and our lawful bases
Where we are the controller, we rely on the following lawful bases under Article 6 of the UK GDPR:
| Purpose | Lawful basis |
|---|---|
| Creating and running accounts, and providing the Service to our customers | Contract, or our legitimate interest in providing the Service to the organisation you belong to |
| Taking payment and managing subscriptions and trials | Contract |
| Sending service emails, such as invitations, email-change confirmations, security notices and trial or billing reminders | Contract and legitimate interests (keeping accounts secure and customers informed) |
| Keeping the Service secure, preventing fraud and abuse, and fixing faults | Legitimate interests |
| Improving the Service, using aggregated information about how features are used | Legitimate interests |
| Answering support requests | Legitimate interests, or contract where you are a customer |
| Keeping accounting and tax records, and responding to lawful requests | Legal obligation |
| Sending marketing emails, if you opt in | Consent, which you can withdraw at any time |
Where we process skills data for a customer, we do so only to provide the Service under our agreement with them.
5. Reports, profiling and automated decisions
The Service analyses skills data to produce reports, for example identifying skills that only one person has, or suggesting training. This is a form of profiling. The Service does not make decisions about anyone by itself. Decisions about people, such as training, recruitment or employment, are made by the customer, and our terms require them to involve human judgement. The Service does not make solely automated decisions that have legal or similarly significant effects on you.
6. Who we share it with
We do not sell personal data. We share it only with:
- Your organisation. Owners of the organisation you belong to can see your account details, skills, proficiency ratings and reports that include them.
- Service providers who process data for us under contract and only on our instructions:
- Stripe, Inc. and Stripe Payments Europe Ltd, for payments and subscriptions;
- [hosting provider], for hosting the Service and its databases in [region];
- [email provider], for sending service emails.
- Professional advisers, such as lawyers and accountants, where needed.
- Authorities, where we are required to by law.
- A buyer or successor, if our business or its assets are sold or reorganised, subject to this notice.
An up-to-date list of the sub-processors we use for customer data is available on request.
7. International transfers
We store the Service's data in [the UK / the European Economic Area]. Some providers, such as Stripe, may process data in the United States or elsewhere. Where personal data leaves the UK or EEA, we make sure it is protected, for example by the country having adequacy regulations or an adequacy decision, by the UK Extension to the EU–US Data Privacy Framework, or by the International Data Transfer Agreement or Standard Contractual Clauses with the UK Addendum.
8. How long we keep it
- Account, organisation and skills data: for as long as the account is active. When an organisation closes its account, we delete this data within 30 days, unless the customer asks for an export first.
- Invitations: kept with the organisation's account data, and deleted with it.
- Billing and tax records: for 6 years after the end of the financial year they relate to, as required by UK law.
- Security logs: for up to [90] days.
- Backups: deleted data may remain in encrypted backups for up to [35] days before they are overwritten.
9. How we protect it
We use appropriate technical and organisational measures to protect personal data, including encryption in transit (TLS), passwords stored only as strong one-way hashes, access controls that keep each organisation's data separate, rate limiting of sign-in and sensitive actions, and signing users out of all sessions when their password or email address changes. Access to customer data by our staff is restricted to those who need it.
10. Your rights
You have the right to:
- access the personal data we hold about you and receive a copy;
- have inaccurate data corrected. You can update your name and email from your profile;
- have your data erased in certain circumstances;
- restrict or object to our use of your data, including where we rely on legitimate interests;
- data portability: receive data you gave us in a structured, machine-readable format; and
- withdraw consent at any time, where we rely on consent.
To exercise a right, email [privacy@gapzero.com]. We will reply within one month, and may need to confirm your identity first. If the request concerns skills data held for your employer, we will pass it to them or help them respond, as they are the controller.
11. Cookies and similar technologies
We use only what is strictly necessary for the Service to work: a sign-in token stored in your browser, and a cookie that tells the app you are signed in. These are needed to provide the Service you ask for, so they don't require consent. We do not use advertising or third-party analytics cookies. If that changes, we will update this notice and ask for your consent where required.
12. Children
The Service is for businesses and their staff. It is not intended for anyone under 16, and we do not knowingly collect their data.
13. Complaints
If you have a concern, please contact us first so we can try to put it right. You also have the right to complain to the Information Commissioner's Office, the UK supervisory authority: ico.org.uk/make-a-complaint, telephone 0303 123 1113. If you are in the EU, you can contact your local data protection authority.
14. Changes to this notice
We may update this notice from time to time. The date at the top shows when it last changed. If we make significant changes, we will tell you by email or in the Service.